C

Web › Module 4 › Lesson 4

BeginnerModule 4Lesson 4/6

Security Misconfigurations

Default creds, verbose errors, open buckets, and debug endpoints—the low-hanging fruit attackers love

15 min+55 XP3 quiz
Module progress4 of 6

Visual · web_developer

Security misconfiguration is the gap between what you think you deployed and what is actually exposed—often worse in cloud and container setups.

Opening

The attack was “admin / admin”

Not every breach needs a zero-day. Often the panel was left on the public internet with factory defaults, debug mode printed stack traces with database URLs, or an S3 bucket was “public” because a template said so. Misconfiguration is OWASP A05 because it is common, easy to scan for, and devastating when combined with other flaws.

1. Typical Misconfiguration Hits

  • Default accounts

    Tomcat manager, Jenkins, Grafana, router UI—unchanged passwords.

  • Verbose errors

    Stack traces revealing paths, SQL, or secret names.

  • Open cloud storage

    Public read on buckets with backups or PII.

  • Unneeded features

    Directory listing, TRACE enabled, admin routes on prod.

2. Recon Commands (Authorized Targets)

Check response headers on your staging sitecurl -sI https://staging.yourdomain.example | grep -iE \\ "server:|x-powered-by:|access-control"

curl -sI https://staging.yourdomain.example | grep -iE \\
  "server:|x-powered-by:|access-control"

Look for exposed admin paths in YOUR labffuf -u https://staging.yourdomain.example/FUZZ \\ -w /path/to/common.txt -mc 200,301,302 -t 20 # Only on hosts you own or have scope to test

ffuf -u https://staging.yourdomain.example/FUZZ \\
  -w /path/to/common.txt -mc 200,301,302 -t 20
# Only on hosts you own or have scope to test

3. Hardening Checklist

• Remove default credentials and disable unused services • Separate dev/stage/prod; no debug in production • Automate config baselines (CIS benchmarks, IaC reviews) • Least privilege on cloud IAM and bucket policies • Patch management and inventory—you cannot secure what you do not know exists

Scan yourself first

Run misconfiguration checks against your own infrastructure before attackers do. Document findings and fix defaults before launch—not after a breach.

Knowledge Check

1

Security misconfiguration often includes:

Multiple choice

Knowledge Check

2

True or False: Verbose error pages in production can leak sensitive implementation details.

True or False

Knowledge Check

3

Public cloud storage buckets are risky because:

Multiple choice

← Previous

Answer all 3 knowledge checks to continue. (0/3 answered)